The run reads untrusted ticket text, and `Bash(npx tsx:*)` allowed
`npx tsx -e` with YOUTRACK_TOKEN and the Anthropic key in the environment.
- Allow only the youtrack-cli scripts the prompt uses.
- Force every comment from this run to be private, so it can't publish
anything it read.
- Pass the dispatch input via env instead of interpolating it into `run:`.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Moves the Area field agent from the JetBrains/vim-claude-robot repository
into this one, where the YouTrack tooling and the Claude proxy setup
already exist.
The previous agent passed a single prompt to `claude -p` with the ticket
summary, the ticket description, and the list of Area values. It had no
tools, so it could not read the ticket comments, see how an Area value is
used on other tickets, or look at the source. The new workflow runs an
agent that reads the ticket, searches comparable tickets when the right
value is not obvious, and greps the code when the ticket names a command
or an option.
A script selects the ticket, so a run with nothing to triage ends before
the agent starts.
Add to the YouTrack tools:
- searchTickets, which reports the Area values of the tickets it finds
- getAreaValues and setArea, which reject unknown value names before
writing and verify the field afterwards
- setTagByName, so a tag no longer needs a hardcoded id
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
